Resolve tenant & scope
Credentials and provider connection are selected server-side.
Integrations & controls
Connect the workflow. Preserve control.
Aestar advances only what the provider and policy can safely support. Ambiguous writes become visible reconciliation work—not a success message and not a blind retry.
Readiness matrix
Status is specific, not decorative.
“Engineered” means the path and tests exist. “Launch-gated” means a real credential, acceptance test, or operator approval still separates it from production use.
| Integration | Status | Current scope | Before production |
|---|---|---|---|
| Google Calendar | Engineered · gated | Availability and bounded booking with tenant timezone and authenticated calendar fingerprint. | Controlled write, read-back reconciliation, rollback owner, and no false confirmation after ambiguity. |
| Retell voice | Engineered · gated | Agent, knowledge, number, and call-analysis boundaries with durable operation state. | Approved provider mutation, inventory review, test call, escalation check, and rollback. |
| Twilio messaging | Inbound only · outbound off | Signed inbound events, STOP evidence, tenant routing, replay handling, and carrier-status storage. | A2P, consent, quiet hours, frequency, lookup, durable outbox, delivery reconciliation, and approval. |
| Transactional email | Suppressed by environment | Server-only delivery, safe-recipient policy, and no secret or customer-data exposure in review artifacts. | Approved sender/domain, template review, recipient policy, bounce handling, and production monitoring. |
| Stripe | Business contract prepared | Trusted checkout metadata and webhook mapping to 500 monthly live voice minutes. | Create the approved Business price, configure its server secret, and run test-mode acceptance. |
| First CRM | Boundary prepared | Import and internal action records; no live provider write is claimed. | Choose from signed demand, then pass sandbox, idempotency, reconciliation, field, and rollback tests. |
Mutation protocol
Every external write has a memory.
A provider timeout cannot tell us whether the write happened. The correct response is reconciliation, not optimism.
Persist operation ID
The intended mutation exists before the first provider call.
Submit once
Provider identifiers and the smallest supported payload are retained.
Read before retry
Confirmed, rejected, or blocked pending evidence—never guessed.
Data boundary
The browser never grants itself authority.
Prompts, hidden fields, query parameters, and model output are treated as untrusted input. Server policy decides what is allowed.
Identity01
Tenant-scoped access
Secure cookie sessions resolve the account; browser-supplied plan or tenant authority is ignored.
Secrets02
Server-side providers
Provider credentials stay out of HTML, client storage, logs, fixtures, screenshots, and review packets.
Evidence03
Durable dispositions
Acceptance, delivery, suppression, opt-out, and reconciliation are separate states with their own evidence.
Start with one workflow, not six logos.
We scope the smallest integration that proves an operational outcome.